BMS: console skip past BUS_HEALTH; PC1/PC0 gpio readbacks; PC0=!PC1 invariant

The BUS_HEALTH auto-gate (shutdown loop sensed closed) is currently the
only way toward PRECHARGE, which blocks HV-path testing whenever the
loop is unavailable. The console now always allows manual stepping:
LV->BUS_HEALTH, LV->PRECHARGE (skip), BUS_HEALTH->PRECHARGE, and
ENERGIZED->LV teardown, with a matching PRECHARGE entry case in
LVPowerTransition. With a healthy loop this mirrors the automatic path;
with an open loop the per-state Shutdown/AIR- backouts still eject to
LV_POWER on real builds.

Under the bench master macro (FEB_BMS_DISABLE_ADBMS_CHECKS=1) the
loop-dependent enforcement is compiled out so a skipped-in precharge can
run with an unpowered shutdown loop: PRECHARGE/ENERGIZED Shutdown/AIR-
backouts and the contactor-feedback weld check. IVT freshness, the
precharge voltage gate, and the 10s timeout remain enforced.

Diagnostics: BMS|gpio now reads back PC1 (BMS shutdown relay) and PC0
(BMS indicator); fault_begin() raises PC0 so it is the inverse of PC1
in every fault type, not just FAULT_BMS/FAULT_CHARGING.

Author: ZacharyBer

BMS/Core/User/Inc/FEB_HW_Relay.h

@@ -47,12 +47,24 @@ void FEB_HW_Precharge_Set(bool closed);
  */
 void FEB_HW_BMS_Shutdown_Set(bool closed);
 
+/**
+ * @brief Read back the actual BMS shutdown relay pin level (PC1)
+ * @return true if the pin is high (relay commanded closed)
+ */
+bool FEB_HW_BMS_Shutdown_Get(void);
+
 /**
  * @brief Set BMS indicator output
  * @param on true = indicator on, false = indicator off
  */
 void FEB_HW_BMS_Indicator_Set(bool on);
 
+/**
+ * @brief Read back the actual BMS indicator pin level (PC0)
+ * @return true if the indicator output is driven on
+ */
+bool FEB_HW_BMS_Indicator_Get(void);
+
 /**
  * @brief Set fault indicator LED
  * @param on true = LED on (fault active), false = LED off

BMS/Core/User/Src/FEB_Commands.c

@@ -258,6 +258,18 @@ static bool is_state_transition_allowed(BMS_State_t current, BMS_State_t target)
   {
     return true;
   }
+  /* Manual stepping through the HV path (skips the BUS_HEALTH auto-gate).
+   * With a healthy shutdown loop this mirrors what the SM does on its own;
+   * with the loop open, the per-state Shutdown/AIR- backouts eject to
+   * LV_POWER. ENERGIZED->LV_POWER is the teardown (opens AIR+/precharge). */
+  if ((current == BMS_STATE_LV_POWER && (target == BMS_STATE_BUS_HEALTH_CHECK || target == BMS_STATE_PRECHARGE)) ||
+      (current == BMS_STATE_BUS_HEALTH_CHECK && target == BMS_STATE_PRECHARGE) ||
+      (current == BMS_STATE_ENERGIZED && target == BMS_STATE_LV_POWER))
+  {
+    LOG_W(TAG_BMS, "Manual transition override: %s -> %s", FEB_CAN_State_GetStateName(current),
+          FEB_CAN_State_GetStateName(target));
+    return true;
+  }
   if (target == BMS_STATE_BATTERY_FREE)
   {
     if (current == BMS_STATE_LV_POWER || current == BMS_STATE_BUS_HEALTH_CHECK)
@@ -285,6 +297,7 @@ static void subcmd_state(int argc, char *argv[])
     FEB_Console_Printf("        charging(8), balance(9), fault_bms(10), fault_bspd(11),\r\n");
     FEB_Console_Printf("        fault_imd(12), fault_charging(13)\r\n");
     FEB_Console_Printf("\r\nSafe transitions: ENERGIZED<->DRIVE, LV/BUS_HEALTH->BATTERY_FREE, ->FAULT_*\r\n");
+    FEB_Console_Printf("Manual: LV->BUS_HEALTH/PRECHARGE, BUS_HEALTH->PRECHARGE, ENERGIZED->LV\r\n");
     return;
   }
 
@@ -345,6 +358,7 @@ static void subcmd_state(int argc, char *argv[])
     FEB_Console_Printf("Error: Transition %s -> %s not allowed\r\n", FEB_CAN_State_GetStateName(current_state),
                        FEB_CAN_State_GetStateName(new_state));
     FEB_Console_Printf("Allowed: ENERGIZED<->DRIVE, LV/BUS_HEALTH->BATTERY_FREE, ->FAULT_*\r\n");
+    FEB_Console_Printf("Manual: LV->BUS_HEALTH/PRECHARGE, BUS_HEALTH->PRECHARGE, ENERGIZED->LV\r\n");
     return;
   }
 
@@ -376,6 +390,8 @@ static void subcmd_gpio(int argc, char *argv[])
   FEB_Console_Printf("  Reset Button:    %s\r\n", FEB_HW_Reset_Button_Pressed() ? "PRESSED" : "NOT_PRESSED");
 
   FEB_Console_Printf("Outputs:\r\n");
+  FEB_Console_Printf("  BMS SHDN (PC1):  %s\r\n", FEB_HW_BMS_Shutdown_Get() ? "CLOSED" : "OPEN");
+  FEB_Console_Printf("  BMS IND (PC0):   %s\r\n", FEB_HW_BMS_Indicator_Get() ? "ON" : "OFF");
   FEB_Console_Printf("  TSMS Indicator:  %s\r\n", FEB_HW_TSMS_Indicator_Get() ? "ON" : "OFF");
 
   FEB_Console_Printf("\r\nHV Safe: %s\r\n", FEB_HW_Is_HV_Safe() ? "YES" : "NO");

BMS/Core/User/Src/FEB_HW_Relay.c

@@ -41,6 +41,16 @@ void FEB_HW_BMS_Shutdown_Set(bool closed)
   HAL_GPIO_WritePin(BMS_A_GPIO_Port, BMS_A_Pin, closed ? GPIO_PIN_SET : GPIO_PIN_RESET);
 }
 
+bool FEB_HW_BMS_Shutdown_Get(void)
+{
+  return HAL_GPIO_ReadPin(BMS_A_GPIO_Port, BMS_A_Pin) == GPIO_PIN_SET;
+}
+
+bool FEB_HW_BMS_Indicator_Get(void)
+{
+  return HAL_GPIO_ReadPin(BMS_IND_GPIO_Port, BMS_IND_Pin) == GPIO_PIN_SET;
+}
+
 void FEB_HW_BMS_Indicator_Set(bool on)
 {
   HAL_GPIO_WritePin(BMS_IND_GPIO_Port, BMS_IND_Pin, on ? GPIO_PIN_SET : GPIO_PIN_RESET);

BMS/Core/User/Src/FEB_Main.c

@@ -110,6 +110,7 @@ void FEB_Init(void)
   LOG_W(TAG_MAIN, "Bench mode: voltage/temp enforcement AND the cell-monitor");
   LOG_W(TAG_MAIN, "data-timeout fault are BYPASSED. Do NOT run a real pack.");
   LOG_W(TAG_MAIN, "Pack voltage FORCED to %.1fV for bench precharge", (double)FEB_BMS_BENCH_PACK_VOLTAGE_V);
+  LOG_W(TAG_MAIN, "Shutdown/AIR- backouts and contactor-feedback fault DISABLED");
 #endif
 
 #if FEB_BMS_DISABLE_TEMP_CHECKS

BMS/Core/User/Src/FEB_SM.c

@@ -91,7 +91,9 @@ static volatile uint8_t shutdown_open_count = 0;
 /* Debounce timers for evaluate_faults() (0 = condition currently clear) */
 static uint32_t overcurrent_start_tick = 0;
 static uint32_t imd_open_start_tick = 0;
+#if !FEB_BMS_DISABLE_ADBMS_CHECKS
 static uint32_t contactor_mismatch_start_tick = 0;
+#endif
 
 /* The IMD status S-R latch powers up LOW; SHS_IMD only goes high once the
  * operator resets the IMD. Low is benign until then — only after the latch
@@ -203,8 +205,10 @@ static void fault_begin(BMS_State_t fault_type)
   /* Stop cell balancing immediately */
   FEB_Stop_Balance();
 
-  /* Open BMS shutdown relay immediately (disables HV path) */
+  /* Open BMS shutdown relay immediately (disables HV path). The BMS
+   * indicator (PC0) is always the inverse of the relay pin (PC1). */
   FEB_HW_BMS_Shutdown_Set(false);
+  FEB_HW_BMS_Indicator_Set(true);
   LOG_W(TAG_SM, "BMS shutdown relay opened");
 
   /* Turn on fault indicator */
@@ -399,7 +403,10 @@ static void evaluate_faults(void)
   /* (e) RECOMMENDED: contactor feedback plausibility (weld/stuck detection).
    * Compare commanded vs sensed AIR+/precharge in steady HV states. Skipped
    * while the non-blocking energize/charging settle is in flight (the sense
-   * legitimately disagrees with the state label during that window). */
+   * legitimately disagrees with the state label during that window).
+   * Bench: compiled out — AIR+ sense follows shutdown-loop power the bench
+   * doesn't have, so it would fault every console-skipped energize. */
+#if !FEB_BMS_DISABLE_ADBMS_CHECKS
   {
     bool expect_air_plus = (s == BMS_STATE_ENERGIZED || s == BMS_STATE_DRIVE || s == BMS_STATE_CHARGING);
     bool expect_precharge = (s == BMS_STATE_PRECHARGE || s == BMS_STATE_CHARGER_PRECHARGE);
@@ -435,6 +442,7 @@ static void evaluate_faults(void)
       contactor_mismatch_start_tick = 0;
     }
   }
+#endif
 }
 
 /* ============================================================================
@@ -608,6 +616,16 @@ static void LVPowerTransition(BMS_State_t next_state)
     updateStateProtected(next_state);
     break;
 
+  case BMS_STATE_PRECHARGE:
+    /* Console-requested skip past BUS_HEALTH_CHECK. Same entry actions as
+     * HealthCheckTransition; the normal PRECHARGE backout/timeout still
+     * applies (unless compiled out by the bench master macro). */
+    LOG_W(TAG_SM, "Bus health check skipped via console, entering PRECHARGE");
+    FEB_HW_AIR_Plus_Set(false);
+    FEB_HW_Precharge_Set(true);
+    updateStateProtected(next_state);
+    break;
+
   case BMS_STATE_DEFAULT:
     /* 1->2: shutdown loop ("ESC/TSMS") closed -> bus health check. */
     if (FEB_HW_Shutdown_Sense() == FEB_RELAY_STATE_CLOSE)
@@ -710,6 +728,7 @@ static void PrechargeTransition(BMS_State_t next_state)
     break;
 
   case BMS_STATE_DEFAULT:
+#if !FEB_BMS_DISABLE_ADBMS_CHECKS
     /* Safety check with debounce: require multiple consecutive OPEN readings to filter transients */
     if (FEB_HW_Shutdown_Sense() == FEB_RELAY_STATE_OPEN || FEB_HW_AIR_Minus_Sense() == FEB_RELAY_STATE_OPEN)
     {
@@ -726,6 +745,7 @@ static void PrechargeTransition(BMS_State_t next_state)
     {
       shutdown_open_count = 0; /* Reset counter on good reading */
     }
+#endif
 
     /* Start precharge timer on first entry */
     if (precharge_start_time == 0)
@@ -797,13 +817,15 @@ static void EnergizedTransition(BMS_State_t next_state)
     break;
 
   case BMS_STATE_DEFAULT:
+#if !FEB_BMS_DISABLE_ADBMS_CHECKS
     /* Safety check: go back to LV if shutdown or AIR- opens */
     if (FEB_HW_Shutdown_Sense() == FEB_RELAY_STATE_OPEN || FEB_HW_AIR_Minus_Sense() == FEB_RELAY_STATE_OPEN)
     {
       LOG_W(TAG_SM, "Shutdown/AIR- open while energized, returning to LV_POWER");
       EnergizedTransition(BMS_STATE_LV_POWER);
       break;
     }
+#endif
 
     /* Ready-to-drive gate (4->5): enter DRIVE only on a fresh R2D from DASH. */
     if (FEB_CAN_DASH_IsReadyToDrive(R2D_TIMEOUT_MS))

BMS/VERSION

@@ -1 +1 @@
-1.7.13
+1.7.14

VERSION

@@ -1 +1 @@
-1.7.29
+1.7.30